CVE-2025-24299
Published: 11 November 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-24299 is an improper input validation vulnerability (CWE-20) in certain Intel(R) CIP software versions prior to WIN_DCA_2.4.0.11001, specifically within Ring 3 User Applications. This flaw may allow an escalation of privilege.
An unprivileged software adversary with authenticated user privileges can exploit the vulnerability using a low-complexity attack, potentially via network access without special internal knowledge or user interaction. Exploitation enables escalation of privilege with high impacts to confidentiality, integrity, and availability, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Intel's security advisory INTEL-SA-01328, available at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01328.html, addresses the issue. Mitigation requires updating the affected Intel(R) CIP software to version WIN_DCA_2.4.0.11001 or later.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability explicitly enables escalation of privilege through improper input validation exploitation in user-mode software, directly mapping to T1068: Exploitation for Privilege Escalation.